1. Field of the Invention
The invention relates to a method for operating a network having two control devices and at least one peripheral device, and also to a network of this type.
2. Description of the Related Art
Networks, which are often based on the so-called field bus standard, are used in a known manner to control factories, such as production plants. It is of special importance in such cases to ensure an especially high availability of the network and its components to avoid costly downtimes or even accidents which can result from the failure of control of the production plant. It is therefore usual to provide two redundant control devices, of which one, operating as an active control device in each case, issues control signals to the remaining components of the network, with the other in each case serving as a backup control device and only assuming control of the production plant upon failure of the first control device.
With complex plants, it is thus of importance for the backup control device also to be informed at any given time about the status of the plant, so that in the event of a main control device failure the backup control device can take over control seamlessly. For this purpose, synchronization occurs between the control devices. The backup control device can also determine from the synchronization whether the main control device is still active.
The problem that exists here however is that, in the event of a failure of synchronization between the control devices, the backup control device cannot decide whether it is actually the main control device that has failed or merely the synchronization. If the main control device is still active when synchronization has failed, the backup control device may not attempt to take over the control of the plant since otherwise conflicting control signals could be sent from the two devices to the components of the network. As a result, the network can enter an undefined state which can also lead to failure or even to damage to the production plant. It is thus usual to design redundant synchronization devices and synchronization lines between the two control devices.
The disadvantage of this is however that it increases the manufacturing overhead of a network of this type. In addition, even with a redundant synchronization line or synchronization device, it can occur that the main control device is still active while both synchronization lines or synchronization devices have failed at the same time. Here too the problem again occurs of the two control devices simultaneously attempting to take over control of the plant.